What is CVE-2024-23826?

CVE-2024-23826 is a medium-severity vulnerability in Se.math.spbu Spbu Se Site, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 6.8/10. Published 2024-01-29.

How severe is CVE-2024-23826?

Medium severity. CVSS v3 base score is 6.8 out of 10.

Is CVE-2024-23826 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Resource exhaustion in Se.math.spbu Spbu Se Site

CVE-2024-23826

spbu_se_site is the website of the Department of System Programming of St. Petersburg State University. Before 2024.01.29, when uploading an avatar image, an authenticated user may intentionally use a large Unicode filename which would lead to a server-side denial of service under Windows. This is due to no limitation of the length of the filename and the costly use of the Unicode normalization with the form NFKD on Windows OS. This vulnerability was fixed in the 2024.01.29 release.

EPSS: 0.004 (36.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H.

Affected products

Se.math.spbu Spbu_se_site
Spbu-se Spbu_se_site — versions < 2024.01.29

Weakness classification (CWE)

CWE-770 — Allocation of Resources Without Limits or Throttling

Public proof-of-concept exploits

Sim4n6/Sim4n6

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Third Party Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2024-23826?: CVE-2024-23826 is a medium-severity vulnerability in Se.math.spbu Spbu Se Site, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 6.8/10. Published 2024-01-29.
How severe is CVE-2024-23826?: Medium severity. CVSS v3 base score is 6.8 out of 10.
Is CVE-2024-23826 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.